Vanished Snapchat photos can be restored, data retrieval firm says

After you open a Snapchat image, it disappears. But with the right software, those images can be restored, according to a data retrieval company.

Decipher Forensics of Utah says it can extract and restore images sent to Android smartphones on Snapchat even after they have been opened. The company, which specializes in retrieving data that has been deleted, said it can do this by using specialized forensics software to go into the folders used by the Snapchat app. Once it has located the image files, Decipher Forensics then edits the file name in order to restores the images.

The company's claims may be alarming for some users, considering Snapchat markets itself by saying that after content has been viewed, it "disappears forever."

Richard Hickman, a digital forensics examiner with Decipher Forensics, said that within the folders created by the Snapchat app on users' devices, there is one location where all viewed and unviewed images are kept. From the research he has done, those images remain after they are viewed, and as such they can be restored.

Hickman said he hasn't gotten to try his method on all Android devices, but he has been able to retrieve received Snapchat images on all the Android smartphones he has tested. He also said he may be able to do the same with Snapchat on the iPhone, which he began testing this week.

Snapchat also enables users to send videos that disappear after they are viewed. Hickman has not yet tried to extract videos.

Hickman said Decipher Forensics is willing to retrieve Snapchat images for any interested user, but its target market is law enforcement, parents who want to see what their children are sending and attorneys who deal with divorce cases.

The company will charge $300 to $500 for the process, depending on how much data is on a phone. Interested users can call the company and later send in the smartphone through the mail. After it's done, Decipher Forensics says, it sends back the smartphone along with a flash drive that holds the image files it retrieved.

Hickman said users should be careful with the content they send through the app, because the people who receive the content could have it forever.

“If they're willing to, they can send us that phone and then they have access to that picture,” he said. "We could get those pictures back for them.”

Hickman did warn, however, that if Decipher Forensics comes across any material that it believes might be child pornography, the company will turn over the device to law enforcement. Some people use Snapchat to send photos and video with explicit content.

After Hickman's claims became public, Snapchat addressed how it deletes its files in a blog post. The company said it deletes files from its servers and directs its app to delete the files immediately after they have been opened and viewed.

However, Snapchat did warn users to be careful about what they send because it is possible to retrieve images.

"If you’ve ever tried to recover lost data after accidentally deleting a drive or maybe watched an episode of CSI, you might know that with the right forensic tools, it’s sometimes possible to retrieve data after it has been deleted," the company said in its blog. "So… you know… keep that in mind before putting any state secrets in your selfies."